Open WebUI versions 0.11.1 up to 0.11.3 contain an authorization bypass in the OAuth token exchange endpoint that reads role claims only from the provider's userinfo response and preserves an existing role when no role claim is present, ignoring roles carried in the ID token. This flaw lets a user with a linked account whose provider role no longer satisfies the OAuth role policy supply a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange and receive a session that retains the user’s previous role. The result is that the attacker can continue to act with a higher‑privilege role that should have been revoked, potentially enabling unauthorized access to privileged operations or sensitive data.

Open WebUI (open‑webui) is affected. The vulnerability is present in releases 0.11.1 through 0.11.3. Administrators should verify the installed version and plan an upgrade if they are operating any vulnerable release.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available. The flaw is not listed in CISA’s KEV catalog. An attacker only needs a valid provider access token and can target the distributed OAuth token exchange endpoint from a remote location. The exploitation does not require elevated privileges or insider access; it simply leverages the preserved role to create a session that grants the attacker the same privileges as before token revocation.